This invention relates generally to processes for reconstructing network communication sessions using previously stored network packets and, in particular, world wide web browsing sessions that use the TCP/IP communications protocol.
Computer networks have been a boon to information sharing in modem society. Computer users are able to access network resources for useful data and to communicate with other computer users. These networks include local area networks, company wide networks, and wide area networks including the vast world wide web.
Computer users access and exchange massive amounts of data with other users and with network servers and web servers, including email, text files, web pages, and a variety of binary objects such as audio and video. Networks and the worldwide web have developed tremendously over the last few years to provide constantly changing and updated information and even the ability to dynamically create and distribute web pages and other information from real-time data. While real-time changes and dynamic information provide many benefits; they also create an inability to retrieve information in the future that is identical to information from the same source as a past communication.
The ability to reconstruct network communications from raw, stored or captured data is useful because it allows after-the-fact review of dynamically changing information, determination of which network nodes sent and received data, the then-current data sent or received, times of all transmissions or receptions, visualization of the communication, or other analysis. Although the ability exists to download the content and structures of network files and web sites, there is no ability to recreate an actual communication session between a computer user and network sources. Therefore, a need has arisen to capture and store network communications as they occur and to reconstruct the actual network communication as it had previously taken place with respect to the identity of a computer, timing, and content.